CVE-2015-2906

Опубликовано: 23 авг. 2015

Источник: nvd

CVSS2: 9

EPSS Низкий

Описание

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation.

Комментарий

CWE-321: Use of Hard-coded Cryptographic Key

Ссылки

http://www.kb.cert.org/vuls/id/209512
Third Party Advisory
US Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster
http://www.kb.cert.org/vuls/id/209512
Third Party Advisory
US Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:mobile_devices:c4_obd-ii_dongle_firmware:*:*:*:*:*:*:*:*

Версия до 3.4 (включая)

EPSS

Процентиль: 70%

0.00648

Низкий

9 Critical

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-pwmv-666f-8qgp

github

больше 3 лет назад

** DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation. NOTE: the vendor states "This was a flaw for the developer/debugging devices (again not possible in production versions)."